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The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a).. In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to communication(s) filed on 29 June 2005 . 
2a)D This action is FINAL. 2b)EI This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 1 1 , 453 O.G. 213. 

Disposition of Claims 

4) [3 Claim(s) 1-57 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) [3 Claim(s) 1-57 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)D The drawing(s) filed on is/are: a)D accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1 .85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)D All b)D Some * c)Q None of: 

1 .□ Certified copies of the priority documents have been received. 

2.D Certified copies of the priority documents have been received in Application No. . 

3-D Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attachment(s) 

1) ^ Notice of References Cited (PTO-892) 

2) H] Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) D Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/Mail Date . 



4) □ Interview Summary (PTO-413) 
Paper No(s)/Mail Date. . 



5) 
6) 



Notice of Informal Patent Application (PTO-152) 
Other: . 



U.S. Patent and Trademark Office 
PTOL-326 (Rev. 1-04) 



Office Action Summary 



Part of Paper No./Mail Date 20050708 
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DETAILED A CTION 

Claim Rejections - 35 USC B 103 

1 . This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1 .56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 1038 and 
potential 35 U.S.C. 102(f) or (g) prior art under 35 U.S.C. 103(a). 

2. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

3. Claims 1-2, 5-15, 18-28, 31-41, 46-50, 55-57 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over Shannon with Patent Number 6,233,618 in view of Munger et al. with 
Patent Number 6,834,310. 

4. Regarding claim(s) 1,14, 27, Shannon teaches a network domain with routers to route 
traffic in and out, col. 6, lines 17-18, 23 and col. 13, lines 23-26 as "within network device" and 
"router or gateway to the Internet". Shannon teaches monitoring network traffic at said router, 
col. 13, lines 26-28. Shannon teaches determining if sourcing of undesirable traffic occurs at the 
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router, col. 13, lines 34-41 as "screen" and col. 11, lines 1-10. Shannon teaches a processor with 
memory, col. 5, lines 45-46. Shannon teaches denial of service attack or access, col. 14, lines 
42-48. Shannon teaches the invention in the above claim(s) except for explicitly teaching 
recognizing denial of service attacks(DOSA). In that Shannon operates to limit data forwarded, 
the artisan would have looked to the network monitoring arts for details of implementing detailed 
traffic analysis of monitored data. In that art, Munger, a related network monitor, teaches "a 
hostile packet", col. 29, line 32 in order to provide DOSA monitoring. Munger specifically 
teaches "saturating the receiver's processor (a so-called 'denial of service 5 attack)", col. 29, lines 
37-38. Further, Munger suggests "traffic monitoring", col. 18, lines 17 which will result from 
implementing his data recognitioin. The motivation to incorporate DOSA insures that more 
relevant data recognition is used to make a determination. Thus, it would have been obvious to 
one of ordinary skill in the art to incorporate DOS a recognitioin as taught in Munger into the 
monitor described in the Shannon patent because Shannon operates with recognizing data and 
Munger suggests that optimization can be obtained by recognizing DOSA. Therefore, by the 
above rational, the above <claim(s) are rejected. 

5. Regarding claim(s) 2, 15, 28, 41, 50, Shannon teaches said determination is based on 
differential characteristics of traffic routed out, col. 6, lines 45-46 as "access control is based on 
the categories or types of data to be accessed", col. 8, lines 24-30, 49-51, and based on traffic 
routed into the network, col. 13, lines 1-22 as "source address field". 

6. Regarding claim(s) 5, 9, 13, 18, 22, 26, 31, 35, 39, Shannon teaches stopping undesirable 
traffic being sourced, col. 14, lines 29-20. 
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7. Regarding claim(s) 6, 10, 19, 23, 32, 36, Shannon teaches a second routing device or 
network domain through which undesirable traffic is determined, col. 6, lines 1-3. 

8. Regarding claim(s) 7-8, 11-12, 20-21, 24-25, 33-34, 37-38, Shannon teaches detecting 
undesirable traffic between routers and/or domains, col. 6, lines 6-7. 

9. Regarding claim(s) 40, 49, Shannon teaches determining if sourcing of undesirable 
traffic/flow occurs at the router, col. 13, lines 34-41 as "screen" and col. 11, lines 1-10. 

10. Regarding claim(s) 46, 48, 55, 57, Shannon teaches priority levels as groups/categories, 
col. 7, lines 41-42. 

11. Regarding claim(s) 47, 56, Shannon teaches slowing traffic, col. 2, lines 65-66. 



Claim Rejections - 35 USC 3 103 

12. This application currently names joint inventors. In considering patentability of the 
claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various 
claims was commonly owned at the time any inventions covered therein were made absent any 
evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1 .56 to point out 
the inventor and invention dates of each claim that was not commonly owned at the time a later 
invention was made in order for the examiner to consider the applicability of 35 U.S.C. 1038 and 
potential 35 U.S.C. 102(f) or (g) prior art under 35 U.S.C. 103(a). 

13. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth 
in section 102 of this title, if the differences between the subject matter sought to be patented and the prior 
art are such that the subject matter as a whole would have been obvious at the time the invention was made 
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to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be 
negatived by the manner in which the invention was made. 

14. Claims 3-4, 16-17, 29-30, 42-45, 51-54 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Shannon with Patent Number 6,233,618 in view of Trcka et al. with Patent 
Number 6,453,345 and Munger et al. with Patent Number 6,834,310. 

15. Regarding claim(s) 3, 16, 29, 42, 51, Shannon and Muger teach the system described 
above. Shannon and Munger teach the invention in the above claim(s) except for explicitly 
teaching compiling aggregated statistics of traffic data. In that Shannon and Munger operate to 
limit data forwarded, the artisan would have looked to the network monitoring arts for details of 
implementing detailed traffic analysis of monitored data. In that art, Trcka, a related network 
monitor, teaches "a window of time for enabling the bad packets to be evaluated", col. 6, lines 
61-62 in order to provide a more accurate determination, as does Munger. Trcka specifically 
teaches "providing] a temporary record of the good and bad packet data, respectively), and are 
used to enable the system to automatically monitor the traffic near real-time' col. 14, lines 50- 
53 with "comparison", col. 19, lines 23-30 and "statistics", col. 21, line 26. Statistics relevant to 
all data sent is taught. Further, Trcka suggests "the system includes various components for 
automatically analyzing the network traffic in near real-time=, col. 8, lines 64-65 which will 
result from implementing his data analysis. The motivation to incorporate statistics insures that 
more relevant data is used to make a determination. Thus, it would have been obvious to one of 
ordinary skill in the art to incorporate the differential statistics as taught in Trcka into the monitor 
described in the Shannon and Munger patents because Shannon and Munger operate with 
grouping data and Trcka suggests that optimization can be obtained with group statistics. 
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Therefore, by the above rational, the above claim(s) are rejected. 

16. Regarding claims 4, 17, 30, Trcka teaches aggregating said input and output 
characteristics, col. 19, lines 25-27 as "evaluating] the effectiveness of the firewall". Thus, the 
above claim limitations are obvious in view of the combination. 

17. Regarding claim 43-45, 52-54, the Shannon and Trcka patents disclose the method of the 
preceding claims. The Shannon and Trcka patents do not explicitly disclose all the details 
relating to specific types of statistics such as packet lengths, TTL, and inbound versus outbound 
packets,. However, Official Notice is taken MPEP 2144.03 (a)) that details relating to specific 
types of statistics is well known in the art to insure a complete data set. It would have been 
obvious to one of ordinary skill in the art at the time of the application's invention to provide 
details relating to specific types of statistics to obtain the advantages of having a complete data 
set. By the above rational, the claim is rejected. 



Response to Amendment 

1 . The broad claim language used is interpreted on its face and based on this interpretation 
the claims have been rejected. 

2. The limited structure claimed, without more functional language, reads on the references 
provided. Thus, Applicant's arguments can not be held as persuasive regarding patentability. 

3. Based on the new grounds for rejection the applicants arguments are moot. The broad 
claim language used is interpreted on its face and based on this interpretation the claims have 
been rejected. 
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Conclusion 



1 8. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure is disclosed in the Notice of References Cited. A close review of the references is 
suggested. A close review of the Cunningham et al. reference with Patent Number 6,219,786 
and Krishnan reference with Patent Number 6,366,956 is suggested. The other references cited 
teach numerous other ways to perform network device content control, thus a close review of 
them is suggested. 

4. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Stephan Willett whose telephone number is (571)272-3890. The 
examiner can normally be reached Monday through Friday from 8:00 AM to 6:00 PM. 

1 . If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Andrew Caldwell, can be reached on (571)272-3868. The fax phone number for the 
organization where this application or proceeding is assigned is (571)273-8300. 

5. Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is (571) 272-2100. 




Stephan Willett 



Patent Examiner 



July 8, 2005 



